fix: use after free for regexp /()(?\!(?'a')\1)/ #29

diff --git a/src/regcomp.c b/src/regcomp.c
index dad59af1cd2d6e1f02c3f08ad82ca6cf3feb5e27..249aef1372de420bb75299f2c696d6bdb31e099f 100644 (file)
--- a/src/regcomp.c
+++ b/src/regcomp.c
@@ -1853,6 +1853,11 @@ renumber_by_map(Node* node, GroupNumRemap* map)
     r = renumber_node_backref(node, map);
     break;
 
+  case NT_ANCHOR:
+    if (NANCHOR(node)->target)
+      r = renumber_by_map(NANCHOR(node)->target, map);
+    break;
+
   default:
     break;
   }